Automattic vulnerabilities
78 CVEs and advisories name Automattic as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-125120Mongoose: sanitizeFilter not applied on countDocuments
- CVE-2026-125119Mongoose: Connection-level sanitizeFilter not applied
- CVE-2026-125118Mongoose: Prototype pollution via Schema.prototype.virtual()
- CVE-2026-125117Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of…
- CVE-2026-125116Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections
- CVE-2026-112329Sensei LMS 4.26.4 Broken Access Control via save_new_message
- CVE-2026-112328Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX
- CVE-2026-40808WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability
- CVE-2026-106608WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability
- CVE-2026-106601WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability
- CVE-2026-106602WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability
- CVE-2026-66666WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability
- CVE-2026-93485WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-48888WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability
- CVE-2026-57777WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability
- CVE-2026-73562Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
- CVE-2026-42334Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
- CVE-2026-3589WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF
- CVE-2026-22356WordPress Jetpack CRM plugin <= 6.7.0 - Local File Inclusion vulnerability
- CVE-2026-25404WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerability
- CVE-2023-54332Jetpack 11.4 - Cross Site Scripting (XSS)
- CVE-2023-52212WordPress WP Job Manager plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2025-69015WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability
- CVE-2025-15033WooCommerce - Subscriber/Customer+ Order Data Disclosure
- CVE-2023-7320WooCommerce <= 7.8.2 - Sensitive Information Exposure
- CVE-2025-49042WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-57924WordPress Developer Plugin <= 1.2.6 - Cross Site Request Forgery (CSRF) Vulnerability
- CVE-2025-49325WordPress Newspack Newsletters plugin <= 3.13.0 - Open Redirection Vulnerability
- CVE-2025-5062WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting
- CVE-2024-56006WordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerability